- ipv4: validate checksum_start before completing checksum {CVE-2026-99999} - vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115} - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801} - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} - Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049} - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209} - drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209} - nfsd: make sure exp active before svc_export_show {CVE-2024-56558} - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829} - drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} - RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515} - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} - wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414} - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} - mm/khugepaged: fix ->anon_vma race {CVE-2023-52935} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998} - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974} - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548} - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - Squashfs: check block offset is not negative {CVE-2026-90203} - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} - md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262} - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700} - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} - ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641} - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} - sctp: validate cookie AUTH state before use {CVE-2026-74752} - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320} - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493} - libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304} - nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686} - isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-4439} - igbvf: fix double free in `igbvf_probe` {CVE-2021-47589} - scsi: mpt3sas: Fix kernel panic during drive powercycle test {CVE-2021-47565} - drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}